APD/GBA (Belgium) - 19/2020
| APD/GBA - DOS-2018-05421 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(b) GDPR Article 5(1)(f) GDPR Article 5(2) GDPR Article 24 GDPR Article 32 GDPR Article 17 of the law organizing the national registry for natural persons |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 29.04.2020 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | DOS-2018-05421 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | Official site of the Belgian data protection authority (in FR) |
| Initial Contributor: | Maïlys Lemaître |
Belgium's DPA reasserts the principle of accountability of the data processor in accordance article 24 GDPR and the necessity of documenting all processes and procedures resulting thereof.
English Summary
Facts
The plaintiff filed a complaint with the Belgian DPA after noticing that their picture in the national registry had been consulted by a city official without indication of a motive, such as required by article 17 of the Belgian law organizing the national registry, and following the inability of the city to justify the consultation or provide a satisfactory response as to the outcome of its internal enquiry on the matter. The city argued in its defence, that there were clear internal procedures for the consultation of the national registry and that it could therefore have reasonably assumed that the data would be processed lawfully.
Dispute
Is assuming that the data be processed lawfully because of the knowledge of the law and internal procedures by employees sufficient?
Holding
The Belgian DPA reminds that accountability in accordance as understood by article 24 GDPR resides not only in ensuring that the law and the internal procedures relating to data processing be known to employees, but also that those be clearly implemented and documented in order to be able to prove the lawful processing of the data. In this instance, the procedure for consultation of the national registry was inadequate because the motive of consultation had not to be provided in writing, although the motive in itself constitutes the decisive element for determining the lawfulness or not of the data processing.
Comment
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
